40-12-508. Violations; penalties.

(a) If a consumer reporting agency intentionally or negligently violates a valid security freeze by releasing credit information that has been placed under a security freeze, the affected consumer is entitled to:

(i) Notification within five (5) business days following the agency's discovery, or notification from another source, of the release of the information. The notification under this paragraph shall include specificity as to the information released and the third party recipient of the information;

(ii) Notification that the consumer may file a complaint with the federal trade commission and the state attorney general.

(b) If a consumer reporting agency intentionally or negligently violates a valid security freeze by releasing credit information that has been placed under a security freeze and fails to take steps to correct the release and fails to give the notification required under subsection (a) of this section, the affected consumer is entitled to, in a civil action against the consumer reporting agency, recover:

(i) Injunctive relief to prevent or restrain further violation of the security freeze;

(ii) A civil penalty in an amount not to exceed one thousand dollars ($1,000.00) plus any damages available under other civil laws; and

(iii) Reasonable expenses, court costs, investigative costs and attorney's fees.

(c) Each violation of the security freeze shall be counted as a separate incident for purposes of imposing penalties under this section.